From b9cc60deeb0201e263ee011a20b0bce4eb6001f4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 16 Dec 2010 14:53:54 +0100 Subject: preparing for 6.1.2 release --- doc/mmnormalize.html | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 doc/mmnormalize.html (limited to 'doc/mmnormalize.html') diff --git a/doc/mmnormalize.html b/doc/mmnormalize.html new file mode 100644 index 00000000..82f9b6a2 --- /dev/null +++ b/doc/mmnormalize.html @@ -0,0 +1,56 @@ + + +Log Message Normalization Module (mmnormalize) + + +back + +

Log Message Normalization Module

Module Name: mmnormalize

Available since: 6.1.2+ +

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

This module provides the capability to normalize log messages via +liblognorm. Thanks to libee, unstructured text, +like usually found in log messages, can very quickly be parsed and put into +a normal form. This is done so quickly, that it usually should be possible +to normalize events in realtime. +

This module is implemented via the output module interface. That means that +mmnormalize should be called just like an action. After it has been called, +the normalized message properties are avaialable and can be access. These properties +are called the "CEE" properties, because liblognorm creates a format that is +inspired by the CEE approach. +

Note that mmnormalize should only be called once on each message. Behaviour is +undifined if multiple calls to mmnormalize happen for the same message. +

Configuration Directives:

$mmnormalizeRuleBase <rulebase-file>
+Specifies which rulebase file is to use. This file is loaded. If there are +multiple mmnormalize instances, each one can use a different file. However, +a single instance can use only a single file. This parameter MUST be given, +because normalization can only happen based on a rulebase. +
$mmnormalizeUseRawMsg <on/off>
+Specifies if the raw message should be used for normalization (on) or just the +MSG part of the message (off). Default is "off". +

+Caveats/Known Bugs: +

None known at this time. + +

Sample:

This activates the module and applies normalization to all messages:
+

+ +

[rsyslog.conf overview] +[manual index] [rsyslog site]

+ -- cgit